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1 Overview 

This Systems Engineering Management Plan (SEMP) addresses the test- vehicle design, 
integration, and flight-testing for NASA’s Traffic Aware Planner (TAP) software application. 
TAP is a three-dimensional aircraft trajectory optimizer developed to support NASA’s Airspace 
Systems Program (ASP) and NextGen Concepts and Technology Development (CTD) projects. 
TAP uses a pattern-based genetic algorithm to generate flight path optimizations, based on own- 
state information combined with traffic, weather, and airspace boundary inputs obtained from 
external sources. TAP uses these data to offer aircrew vertical and lateral flight-path 
optimizations which can achieve significant fuel and time savings, while automatically avoiding 
traffic, weather, and restricted airspace conflicts. A sample TAP screen is shown in Figure 1. 



TASAR Software Overview 



Nov 11,2013 TASAR Test S ubject Pre-F I ig ht Br refrng 37 


Figure 1. Sample TAP screen. 


TAP’s architecture and algorithms were derived from the NASA Autonomous Operations 
Planner (AOP) (Ballin, Sharma, Vivona, Johnson, & Ramiscal, 2002; Vivona, Karr, & Roscoe, 
2013) incorporated in NASA Langley’s Air Traffic Operations Laboratory (ATOL) (NASA, 


NASA TASAR Systems Engineering Management Plan 


2 


2013). The flight-evaluation program entailed the migration of TAP from the simulator to an 
aircraft in order to validate its usability in a representative airborne environment. The program 
comprised three major activities: (1) development of the TAP application for Class 2 (portable) 
EFB applications (Federal Aviation Administration, 2012); (2) development and assessment of 
the TAP Human Machine Interface (HMI); and (3) assessment of TAP in a representative flight 
environment. This plan addresses the 24-month development program culminating in the TAP 
flight evaluations that were successfully concluded in November 2013. 

TAP data sources include: Traffic Alert and Collision Avoidance System (TCAS) data; 
satellite broadband data; and Automatic Dependent Surveillance - Broadcast (ADS-B) traffic 
files. These capabilities are already available to a large cross-section of Air Transport and 
business aircraft that form the initial target market for TAP. The Federal Aviation Administration 
(FAA) has mandated ADS-B Out installation on most aircraft operating in U.S. airspace by 
January 1, 2020 as part of its Next Generation Air Transportation System (NextGen). TCAS is 
already broadly mandated by the International Civil Aviation Organization (ICAO) for 
installation in large (> 13,0001b) transport aircraft, and an increasing number of aircraft already 
have installed broadband capability. 

A key step in achieving the rapid operational deployment of TAP is the successful 
verification and validation of the system in a representative flight environment. This posed 
several challenges in the development program. Among the most significant was the requirement 
to port the foundational Autonomous Operations Planner (AOP) software from its original 
embedded-avionics simulator-based origins to an embedded avionics environment on the flight 
deck, hosted on an Electronic Flight Bag (EFB) platform. Considerable attention must also be 
paid to the selection and modification of a suitable flight-test platform that will maximize the 
long-term potential for the operational deployment of TAP, while minimizing immediate program 
risks. The systems engineering approach used to achieve these objectives is outlined in this 
document. 

1.1 Scope 

This SEMP relates to the integration of the TAP software into a suitably modified 
Piaggio PI 80 Avanti test platform (S/N 1037) for the purposes of evaluating TAP; it does not 
address the TAP software development process, except for the integration aspects. The SEMP 
captures the essence of the extensive systems engineering planning activities that went into the 
program, but it is not strictly a plan, because the TAP flight trials were successfully completed in 
November 2013. Most of the following sections reflect completed process, with known outcomes 
to the decisions that were taken over the past two years. 
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1.2 Limitations 

Advanced Aerospace Solutions, LLC. (“AdvAero”) conducted the TAP integration and 
testing as a subcontractor to Engility Corporation, NASA’s prime contractor for the program. 
Because of these relationships, much of the material is confidential in nature and cannot be freely 
reproduced within this document. This material only addresses a small subset of the program 
technical documentation, but sufficient information has been included wherever possible to 
facilitate a good understanding of the system engineering process that were used. 

2 Applicable Documents 

The latest revisions of the following documents apply: 

2.1 Supporting Project Documents 

A. ADV-TASAR-DEL-005 Flight-Demonstration Aircraft Modification Plan , Initial 
Issue, May 17, 2012. 

B. Marinvent Corporation Flight Test Operations Manual (FTOM), Rev 1 August 

12,2011. 

C. Marinvent Corporation STC SA 05-104 Honeywell Epic Control Display System 
Installation Piaggio PI 80 Avanti C-GJMM / 1037 Issue No. 1 dated November 
02, 2005. 

D. Marinvent Corporation STC 0-LSA12-151/D Str. Prov. GPS Antenna & 
Miscellaneous Equipment Installation, Issue No. 1 dated October 19, 2012. 

E. Marinvent Corporation STC 0-LSA12- 171/D EMS Aviation Aspire Satcom 
System Installation, Issue No. 1 dated October 24, 2012. 

F. Marinvent Corporation STC 0-LSA12- 172/D NASA TASAR Program Provisions, 
Issue No. 1 dated October 22, 2012. 

G. NASA LaRC Minutes of May 10, 2012 Meeting of the Airworthiness and Safety 
Review Board (ASRB) dated May 15, 2012. 

H. NNL12AA06C, Traffic Aware Strategic Aircrew Requests (TASAR) Traffic 
Aware Planner (TAP) Interface Control Document (ICD), Version 1.8, January 
22,2013. 

I. NNL12AA06C, Initial Analysis of Operational Use Cases and Methodologies, 
Jeff Henderson (Engility Corporation), May 31, 2012w. 

J. NNL12AA06C DEL 7 NASA & FAA Flight-Trial Approval Requirements, Initial 
Issue, June 30, 2012. 

K. NNL 1 2AA06C, Statement of Work for Traffic Aware Strategic Aircrew Requests 
(TASAR) Analysis and Development, as approved. 

L. NNL12AA06C, TASAR Flight-Trial Hazard Analysis, vl.O Nov 9, 2012. 
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M. NNL12AA06C DEL 11, TASAR Flight Trial Research Plan, Draft VI. 0, Dec 21, 
2012 . 

N. NNL12AA06C FTOSR DEL- 19, Traffic Aware Strategic Aircrew Request Flight 
Test Operations and Safety Report. Version 1.3 August 13, 2013. 

O. NNL12AA06C TASAR Flight Trial Test Plan, vl.O Dec 21, 2012. 

P. Skyservice SMS Manual, No. 23, Issue 2, CAR 573, November 15, 2012. 

2.2 Government / Regulatory Documents 

Q. 14 CFR Part 1230, Protection of Human Subjects, June 18, 1991 or later edition. 

R. LMS-CP-0904, Authorizing Flight Aboard Non-LaRC Aircraft, Rev C, July 26, 

2012 . 

S. LMS-OP-783 1NASA Langley, Conducting Research Activities in the Research 
Directorate (RD), Rev A: RD. 

T. LPR 7100.10 NASA Langley Procedural Requirements Protection of Human 
Research Subjects, October 29, 2010. 

U. NASA DOP-0-300, Aircrew Flight Operations Manual, Revision 1, Expires 
October 22, 2015. 

V. NPD 7100.8E NASA Policy Directive Protection of Human Research Subjects 
(Revalidated with admin, changes 6/14/2007): May 31, 2002. 

W. NPD 7900.4C NASA Policy Directive, NASA Aircraft Operations Management, 
April 08, 2009. 

X. NPR 7100.1 NASA Procedural Requirements, Protection of Human Research 
Subjects (Revalidated 7/7/08), effective date: March 28, 2003. 

Y. NPR 7900. 3C NASA Procedural Requirements, Aircraft Operations Management 
Manual, July 15, 2011. 


2.3 Industry Reference Documents 

Z. ARINC 424 Navigation System Data Base Standard, ARINC, Inc. 

AA. ARINC 429 Digital Information Transfer System, ARINC, Inc. 

BB. ARINC 834 Aircraft Data Interface Function (ADIF) standard, ARINC, Inc. 

CC. RTCA-DO- 1 60G Environmental Conditions and Test Procedures for Airborne 
Equipment. 12/08/2010. RTCA, Inc. 

DD. Federal Aviation Administration AC 23.1309-1E System safety analysis and 
assessment for part 23 airplanes, 2011. 

EE. RTCA-DO- 178C Software Considerations in Airborne Systems and Equipment 
Certification. 12/13/2011. RTCA, Inc. 
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FF. RTCA-DO-254 Design Assurance Guidance for Airborne Electronic Hardware. 
4/19/00. RTCA, Inc. 

GG. RTCA DO-260B Minimum Operational Performance Standards for 1090 MHz 
Extended Squitter Automatic Dependent Surveillance - Broadcast (ADS-B) and 
Traffic Information Services - Broadcast (TIS-B), 12/13/2011 . RTCA Inc. 

HH. SAE ARP 4754. Guidelines for development of civil aircraft and systems. 

(Rev A ed.) SAE International. 2010. 

3 General Description of System Architecture 

The TAP test system architecture derives from the fundamental requirement of 
integrating the TAP software into the airborne test vehicle. TAP is a Windows™ application 
which is hosted on a suitable EFB, laptop, or PC computer that is in turn interfaced to aircraft 
data sources for own-state, ADS-B, TCAS, and broadband connectivity. Multiple instantiations 
of the TAP software may be hosted simultaneously on different computer platforms via wired 
(Ethernet) or wireless (Wi-Fi) connectivity. The test system architecture comprises the following 
principal elements as shown in Figure 2. 

1 . The airborne test-platform, including instmmentation and data sub-systems; 

2. ADS-B/TCAS sub-system; 

3. Broadband sub-system; 

4. Aircraft Interface Device (AID) sub-system, responsible for the interface between the 
TAP software and the aircraft data systems; 

5. PC, EFB, and laptop computer sub-systems; and 

6. The TAP software. 

The relationship between these elements is shown in Figure 2 below. 
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Figure 2 . Test-platform system architecture. 

4 System Engineering Process 

A rapid-prototyping research paradigm was adopted for the TAP flight test program. 

This required a degree of modification to Blanchard’s (2008) classical “top down, integrated, life- 
cycle approach to system design and development.” Four principal factors imposed severe 
systems engineering challenges that necessitated a novel approach to the design process: 

1 . The FAA has yet to fully-define the ADS-B In system requirements that are key to TAP 
functionality, and there is no timetable for an ADS-B In regulatory mandate. The 
principal means of communicating ADS-B data to TAP was therefore not fully defined 
before the system was subjected to a formal flight trial. 

2. As indicated in the introduction, TAP’s architecture and algorithms were derived from 
NASA’s AOP software that has never been deployed in an airborne environment. 

3. Because of the very demanding schedule, development of the TAP software was 
conducted in parallel with the development of the airborne test-bed. This posed 
particular challenges because the two programs were completely co-dependent, yet there 
was no outside framework of top-level system requirements (technical or regulatory) to 
help guide and harmonize these parallel rapid-prototyping development processes. 
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4. The 24-month development schedule from the formation of the Integrated Product Team 
(IPT) to the conduct of the flight trials was extremely compressed, particularly in light of 
the parallel development of the software and the test vehicle. 

5. As discussed in section 5.1 below, a primary objective of the program was to facilitate 
the rapid commercial deployment of the TAP while minimizing changes to existing 
avionics architectures or displays for near-term forward-fit applications. This objective 
imposed conflicting demands of implementing a Technology Readiness Level (TRL) 9 
“production ready” integration solution using TRL 4 (laboratory) software. 

4.1 System Operational Requirements 

The TAP program was governed by three sets of operational requirements: (1) TAP 
software functionality requirements, which dictated the capabilities of the software as installed; 
(2) Strategic flight trial requirements, which transcended the performance of the system and 
imposed significant additional data requirements; and (3) commercialization technical 
requirements, which had a major influence on the TAP implementation options in the test vehicle. 

4.1.1 TAP software functionality requirements 

This SEMP does not address the TAP software functionality in detail, as the software is 
Government Furnished Equipment (GFE), delivered “as is.” The data inputs required by the 
software did, however, define important system interfaces with the EFB hardware system and the 
test-bed systems, as discussed in section 4.4. 

4.1.2 Flight trial requirements 

The TAP Statement of Work (SOW) (Project document reference K) includes the 
following flight trial objectives: 

1 . Identification of operational factors unique to the in-flight environment that may affect 
TAP functionality, its data requirements, HMI, and operating procedures. 

2. Development of pilot procedures that are compatible with realistic hardware and 
procedural environments for TAP commercial deployment. 

3. Promotion of readiness for further simulation experiments and flight evaluations geared 
towards making TASAR operations available to the aviation community (avionics 
developers, aircraft operators, and regulatory officials) for near-term operational use. 

4.1.3 Commercialization technical requirements 

NASA requires the TAP system to impose the minimum feasible changes to the existing 
avionics architectures and displays for near-term forward- fit applications on Air Carrier aircraft. 


NASA TASAR Systems Engineering Management Plan 


This objective severely limits the system architectures that can be adopted for the test vehicle, 
essentially eliminating any “breadboard” or “orange wire” (experimental) implementations, 
because these would not be deployable as end-customer solutions. This entailed the maximum 
use of FAA certified Commercial-off-the-shelf (COTS) hardware, as discussed in section 4.6. 

4.2 Maintenance Concept 

All equipment installed as part of the TAP test program will be certified in accordance 
with the Federal Aviation Regulations (FARs). Explicit Instructions for Continuing 
Airworthiness (ICA) were a necessary part of such approvals. The ICAs listed majority of the 
equipment installed for TAP as subject to on-condition maintenance. The few life-limited items 
are tracked electronically using Avtrak® software, along with all of the life-limited systems and 
components in the aircraft. 

4.3 Technical Performance Measures (TPMs) 

Two classes of TPMs applied to the TAP flight test program: (1) TAP system 
performance measures; and (2) regulatory performance measures required for certification of the 
TAP installation and approval for the conduct of the flight trials. The TAP system TPMs for the 
flight trials were very straightforward: the single criterion was the successful functioning of TAP, 
defined by the provision of meaningful trajectory optimizations, while operating in the National 
Airspace System (NAS). Although it would have been possible to define more granular TPMs, 
such as successful Automatic and Manual mode TAP operation, this was not deemed necessary, 
because any successful TAP advisory would indicate that the entire system integration activity 
had been successful. The formal test planning documents included detailed evaluations of every 
TAP mode and function, but these were not success criteria for the test. 

Three forms of regulatory approval applied the TAP installation: (1) Airworthiness 
certification by the regulatory authorities; (2) FAA operational approval for flight in the NAS; 
and (3) NASA approval for the conduct of the experiment. All of these approvals were 
accomplished in accordance with the applicable regulatory and guidance documents, and detailed 
compliance plans were developed for each. The airworthiness approvals for the ADS-B system 
contained extensive TPMs as defined in RTCA DO-260B (Reference GG). All installed avionics 
were additionally certified to meet the extensive TPMs specified in: 

1. DO-160G Environmental Conditions and Test Procedures for Airborne Equipment 

(Reference CC) 

2. FAA AC 23.1309-1E System safety analysis and assessment for part 23 airplanes 

(Reference DD) 
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3. DO-178C Software Considerations in Airborne Systems and Equipment Certification 
(Reference EE) 

4. RTCA-DO-254 Design Assurance Guidance for Airborne Electronic Hardware 
(Reference FF) 

5. SAE ARP 4754. Guidelines for development of civil aircraft and systems (Reference 
HH) 

4.4 Functional Analysis 

The top-level functional requirements for TAP flow from the Concept of Operations: 

(TAP) offers onboard automation for the purpose of advising the pilot of traffic 
compatible trajectory changes that would be beneficial to the flight. The TAP onboard 
automation is expected to be hosted on a Class 2 Electronic Flight Bag (EFB) and 
leverages ADS-B surveillance information to increase the likelihood of ATC approval of 
pilot-initiated trajectory change requests, thereby increasing the portion of the flight flown 
on or near a desired business trajectory. All automation and pilot procedures are fully 
dedicated to a single aircraft which allows tailoring of optimization criteria to the specific 
objectives of each flight and provides for timely responses to changing situations 
(Henderson, 2013). 

4.4. 1 TAP Use Cases 

The following Use Cases were derived from the Concept of Use. TAP will support three 
types of optimization maneuvers, in both automatic and manual modes, as shown in the following 
table. 
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Table 1. 


TAP Operational Scenarios 


Optimization 

Trajectory Change Options 

Lateral 

1 . Direct to downstream waypoint 

2. Change one or two waypoints along route then 
reconnect to route upstream of arrival fix 

Vertical 

• Climb or descend to another altitude 

Combined 
Lateral & 
Vertical 

1 . Direct to downstream waypoint 

2. Change one or two waypoints along route then 
reconnect to route upstream of arrival fix 

3. Climb or descend to another altitude 


Note. Adapted from NNL12AA06C (Project Reference N). 


Further details of the TAP test scenarios appear in section 4.7. 

4.4.2 TAP functional requirements 

TAP requires following logical interfaces to be supported by the test vehicle architecture: 

1 . Comprehensive own-aircraft state information; 

2. ADS-B and TCAS traffic data; 

3. Polygonized Special Use Airspace (SUA) data; 

4. Third-party flight tracking data; 

5. Wind-field data; and 

6. Broadband Internet access. 

4.5 Requirement Allocation 

The existing aircraft architecture determines the allocation of the TAP functions to the 
individual test-bed sub-systems as shown in Table 2. 
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Table 2. 

TAP Functional Allocation 


TAP Function, sub-function 

System allocation 

Interface Type 

1 

Own-aircraft state 



1.1 

Air Data (altitude, airspeed, etc.) 

#1 Air Data 
Computer (ADC) 
via Aircraft 
Interface Device 
(AID) 

ARINC 429 

1.2 

Navigation data 

#1 Flight 
Management 
System (FMS) via 
AID 
#1 GPS 

ARINC 429 
ARINC 429 

1.3 

Flight plan data 

#1 FMS via AID 

ARINC 429 

1.4 

Waypoint geo data 

TAP internal 

ARINC 424 

1.5 

Autopilot data 

Flight Data 
Recorder (FDR) 
Bus via AID 

ARINC 429 

2 

ADS-B and TCAS traffic data 

TCAS 3000 SP 
via AID 

ARINC 429 per 
RTCA DO-260A 

3 

SUA data 

Broadband 
via AID 

Packed, proprietary 

4 

3 rd Party Flight Tracking Data 

Broadband 
via AID 

Provisions only 

5 

Wind-field data 

Broadband 
via AID 

Packed, proprietary 

6 

Broadband Internet 

Iridium satellite 
sub system 

Ethernet 


Note. Adapted from ADV-TASAR-DEL-005 (Project reference A). 


4.6 System Synthesis, Analysis, and Design Optimization 

The decomposition of the allocated system functions into the architectural elements of the 
test vehicle was governed by two “hard” external constraints: the selected aircraft was required to 
retain its Normal Category Certificate of Airworthiness, and it also had to retain its certification 
for single-pilot operations. The former avoids numerous operational restrictions, including 
geographic and weather limitations and constrained passenger carriage; the latter removes 
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restrictions regarding who may occupy the copilot’s seat, and also mitigates the use of uncertified 
software on the non-handling side of the cockpit. Design decisions regarding specific hardware 
requirements were based on the system functional allocations from Table 2, subject to these two 
constraints. 

4.6.1 Test Vehicle 

The test vehicle was the principal element of the system architecture, as it had to support 
all of the functionality required by TAP and its associated systems. In addition to supporting the 
TAP software functionality requirements, the test vehicle also supported the additional 
commercialization and flight trial requirements derived from section 4.1. 

4. 6. 1. 1 Test vehicle top-level system requirements 
The test vehicle shall: 

1 . Accommodate the TAP software and all required internal and external interfaces defined 
in the TAP Interface Control Documents (ICD) (Program reference H). 

2. Accommodate a full test crew of seven personnel, comprising: a safety pilot, a test- 
subject pilot, a test director, a flight test engineer, a data engineer, a TAP software 
specialist, and a NASA monitor or observer. 

3. Have a broad flight envelope (speed and altitude) representative of the turbine business 
aircraft and Air Carrier target market for TAP. A cruise Mach number of 0.6 and a cruise 
altitude in excess of 36,000 feet were deemed representative based on focus group 
discussions. 

4. Have adequate endurance at mid and high altitudes (10,000 - 36,000 feet) to support the 
planned flight durations of 2.5 - 3.0 hours, with legally required IFR reserves. 

5. Be capable of day and night VFR (Visual Flight Rules) and IFR (Instrument Flight Rules) 
day and night operations in moderate icing conditions, to maximize mission flexibility 
and probability of success. 

6. Be capable of performing all of the preceding under single-pilot operations, for the 
reasons already discussed. 

7. Possess a Normal Category Certificate of Airworthiness (C of A), to avoid excessive test 
restrictions associated with Experimental flight permits. 

4.6. 1.2 Test vehicle selection 

The AdvAero Piaggio PI 80 Avanti test-bed aircraft was selected as the TAP test 
platform. The Avanti is a very high performance turboprop pressurized all-weather twin powered 
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by two Pratt & Whitney PT6A-66 turboprops (2x 850 SHP). The aircraft has a very broad flight 
envelope with a cruise speed of approximately 375 KTAS (0.65M) at 28,000 ft. and a ceiling of 
41,000 ft. at ISA. The fuel capacity of 2,900 lbs. yields a maximum endurance of approximately 
four hours, and a maximum range of approximately 1,200 NM. The aircraft is certified with a 
Normal Category Certificate of Airworthiness (C of A) for single pilot day/night/VFR/IFR 
operations in known icing conditions. The aircraft’s payload of 1,560 lbs. allows for a test crew 
of seven, including two pilots, to be flown on most missions. The cabin is arranged with a flight 
test station behind the cockpits which seats two test personnel, and club seating for four 
additional test-crew in the aft cabin, as shown in Figure 3 below. The Piaggio PI 80 Avanti is one 
of a very few aircraft that meet all of the operational requirements for the TASAR trials. 



Test Director & 





Figure 3. Test-vehicle flight test station and cabin. 


4.6.2 EFB and ADS-B subsystems 

The EFB and ADS-B systems are two closely integrated TAP components that were not 
part of the test-vehicle’s baseline avionics suite. As previously discussed, the FAA has yet to 
fully-define the ADS-B-In system requirements, and there are very few commercially deployed 
and certified systems. The selected systems must therefore accommodate future growth via 
firmware upgrades to avoid a rapid obsolescence as the regulations mature. An additional factor 
for the ADS-B selection is the operating band. The two options are 1090 MHz Extended-squitter 
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(1090ES) and the 978 MHz Universal Access Transceiver (UAT). The UAT alternative has 
several advantages, including a less-congested frequency spectrum, but the system is prohibited 
for ADS-B Out operations above 18,000 ft., and is unusable outside the domestic USA, including 
Canada. Both these considerations could limit severely the downstream application of a UAT- 
based TAP system, despite its other benefits. 

The EFB must support an FAA certified operating system (OS), to preclude having to 
change platforms should the FAA decide that the TAP intended functionality merits a certified 
installation in accordance with RTCA DO-178C (Program reference DD). For example, existing 
regulations already prohibit the airborne display of aircraft position using uncertified OSs, and 
might even preclude a graphical TAP user interface. These problems were mitigated from the 
outset by selecting an EFB with a certified OS option. The EFB, TCAS, and ADS-B subsystems 
also require demonstrated interoperability, in order to avoid significant schedule and technical 
risks associated with the integration of three complex dissimilar systems. Accordingly, the EFB 
and ADS-B requirements are as follows: 

4. 6.2. 1 EFB and ADS-B subsystem requirements 
The EFB system shall: 

1. A Class 2 EFB shall be integrated with the test- vehicle and TAP software (the Class of 
EFB is a SOW constraint). 

2. The EFB shall have sufficient processing power, memory, and display resolution, to 
support TAP in accordance with the TAP ICD (Program reference H). 

3. The EFB shall have the option to host a certified OS. 

4. The ADS-B system shall be compatible with the aircraft’s existing avionics to avoid cost 
and schedule risks. 

5. The ADS-B system shall support the 1090ES standard. 

6. The ADS-B, EFB, and TCAS subsystems shall have demonstrated interoperability. 

7. The ADS-B, EFB, and TCAS subsystems shall be certified for aviation applications. 

4. 6. 2. 2 EFB subsystem selection 

Of all of the stated EFB requirements, the need for a certified OS governed, because only 
two COTS EFBs offered this option: the Astronautics NEXIS™ 1 and the Goodrich 
SmartDisplay™. The NEXIS™ form factor is not suitable for the confined cockpit of the Piaggio 
Avanti, leaving the Goodrich solution as the only alternative {Figure 4). This unit includes the 


1 http://tinyurl.com/7vktspg 
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certified DEOS™ OS, which is suitable for all classes of EFB hardware and software types. The 
Goodrich SmartDisplay™ also supports the Windows XP® embedded OS, which will be used to 
host the TAP software if the DEOS certified option is not required. 


SmartDisplay™ EFB 



1 0.4-indi SmartDisplay™ EFB Unit 
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Figure 4. Goodrich SmartDisplay® EFB 
4. 6. 2. 3 ADS-B subsystem selection 

The ACSS TCAS 3000SP 2 system (Figure 5) was selected to perform the TCAS and 
ADS-B functions for the following reasons: 


2 http://www.acssdealeronline.com/prodTCAS300SP.aspx 
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1 . The system is a derivative of the aircraft’s existing T2CAS system, which minimized the 
risks associated with preforming and certifying the upgrade. 

2. The TCAS 3000SP has demonstrated the required interoperability with the Goodrich 
SmartDisplay EFB: the combination hosts the commercially available SafeRoute™ 
application suite. 

3. The TCAS 3000SP is a leading-edge design which supports firmware updates to 
accommodate new functionality as the ADS-B In standards continue to evolve. 

4. The FAA has selected this unit for its test fleet at the W.J.H. Technical Centre, and the 
FAA has subsidized JetBlue Airlines $4.2M to equip 35 Airbuses with this equipment. 3 
These factors may assist the future commercial deployment of TAP on similarly equipped 
aircraft. 



Figure 5. ACSS TCAS 3000SP. © 2014 Advanced Aero Solutions, EEC. Reprinted 

with permission. 

Trade names and trademarks are used in this report for identification only. 

Their usage does not constitute an official endorsement, either expressed or implied, 
by the National Aeronautics and Space Administration. 

4.6.3 AID subsystem 

The TASAR flight trials will require the integration and dissemination of data from 
numerous disparate sources (TCAS, ADS-B, Datalink, etc.). The commercialization 


3 http://tinyurl.com/6tsdspr. "Avionics Today - JetBlue Announce Partnership Agreement for ADS-B Equipage. 
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requirements (section 4.1.3) precluded extensive custom wiring for these interfaces in customer 
aircraft because of cost and certification considerations. For this reason, a data concentrator 
approach was selected to handle all of the communications between the TAP platform and the 
aircraft. Data concentrators used in such applications are commonly referred to as Aircraft 
Interface Devices (AID), which is the nomenclature adopted for this program. The AID 
interfaces between the EFB and TAP to the following subsystems: 

1 . Dual Honeywell CDS/R Electronic Flight Instrument System (EFIS) IC-1080 display 
computers driving 8”xl0” LCD displays; 

2. Universal UNS1-EW FMS with LPV and RNP capability; 

3. Honeywell Laseref V Micro Inertial Reference Unit; 

4. Dual Honeywell AZ 950 micro-ADCs; 

5. Collins APS-65 flight guidance computer and autopilot; and 

6. The aircraft’s R2D2 and workstation computers (c.f. section 4.6.5 below). 

4. 6. 3. 1 AID requirements 
The AID shall: 

1 . Accommodate the internal and external interfaces contained in the TAP software ICD 
(Program reference H), including: 

a. Air Data (altitude, airspeed, etc.); 

b. FMS Navigation data and flight plan data; 

c. GPS position data; 

d. Autopilot state; 

e. ADS-B and TCAS traffic data; and 

f. Broadband Internet connectivity. 

2. Provide all required power and data interfaces to the EFBs that host the TAP application. 

3. Use industry-standard data protocols to interface with EFB hardware to facilitate 
downstream installations. 

4. Be certified for aviation applications. 

4. 6.3.2 AID selection 

The Goodrich AID was selected for the following reasons: 

1 . It is a certified data concentrator that packages ARINC 429 data into a standard network 
protocol (TCP) for transmission over Ethernet, using the Simple Text Avionics Protocol 
(STAP) defined by the ARINC 834 “Aircraft Data Interface Function (ADIF)” standard. 
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2. The unit’s physical interface is based on the ARINC 828 “EFB Standard Interface” 
standard for universal EFB connectors. 

In summary, the combination of the ACSS TCAS 3000SP with the Goodrich 
SmartDisplay™ and AID is the only currently identified system that meets the TAP constraints, 
and which is suitable for installation in the Avanti test-bed aircraft. This combination has the 
advantages of a certified OS option, industry standard interfaces, and proven interoperability 
between the ADS-B and EFB components. These factors should significantly reduce program 
risk, and enhance the prospects of an early commercial deployment of the TASAR system. As an 
added benefit, the ACSS TCAS3000 is at the forefront of Air Carrier deployment for ADS-B 
operations, which will facilitate the eventual deployment of TAP to these customers. 

4.6.4 Broadband subsystem 

The broadband subsystem serves two functions: provision of specified data via Internet 
connectivity, and provision of distributed network services throughout the aircraft cabin for 
wireless TAP clients. 

4. 6. 4. 1 Broadband requirements 
The broadband system shall: 

1 . Interface to a suitable terrestrial Internet source to support the TAP broadband data 
performance requirements defined in the TAP ICD (Program reference H). 

2. Be of a form factor suitable for mounting on the test-bed aircraft, including antenna 
installations. 

3. Provide a router function that supports a minimum of two wired and six wireless clients 
for the broadband data. 

4. Be certified for aviation applications. 

4. 6. 4. 2 Broadband subsystem selection 

Three currently available options offer the required broadband connectivity: Ku-band 
satellite, Inmarsat satellite, and cellular air-to-ground solutions. The Ku option is impractical for 
small aircraft such as the Avanti, and was therefore eliminated. Table 3 contrasts the Inmarsat 
Aspire® solution offered by Honeywell Aerospace with the GogGo® cellular alternative offered 
by Aircell. 
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Table 3. 


Broadband Options Compared 


Characteristic 

Honeywell 
Aspire 200® 

Aircell GoGo Biz ® 
ATG2000 

Communication method 

Inmarsat 1-4 satellite network 

Aircell air-ground cellular 
network 

Antennas 

One blade, top mounted 

Two blades, bottom mounted 

Usable altitude 

All, including on ground 

Geographically dependent, 
typically above 10,000 ft. 

Bandwidth 

200 kbps 

Unpublished 

Data content 

Text only 

Voice and text support 

Wi-Fi WAN support 

802.11 b/g Wi-Fi® 
access, up to 54 clients 

No 

Pricing 

Comparable 

Comparable 


Note. Adapted from published on-line marketing materials 
http://aerospace.honevwell.com/en/products/communication-nav-and- 
surveillance/satellite-communications/terminal-products-inmarsat-l-band/aspire-200 
http://aircell.eom/services/gogo-biz/#ATG2000 

The Honeywell Aspire™ 200 SATCOM was selected primarily because the Avanti test- 
bed did not have sufficient space available to mount the twin bottom-mounted antennas used by 
the Aircell unit, due to other system installations. In addition, the GoGo would have required the 
addition of a router to support the wireless requirement, which would have added weight and 
complexity. 

4. 6. 4. 3 Broadband subsystem description 

The Aspire system was installed and certified via three Canadian Supplemental Type 
Certificates (STC) that covered the antenna structural provisions and the system integration 
aspects (References D, E, and F). Figure 6 shows a schematic of the Aspire 200, as installed. 
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Figure 6. Generic representation of the Honeywell Aspire™ 200 architecture. 

The CCU-200 is a full-service multi-port router and Wi-Fi® Access Point that provides 
network connectivity to multiple cabin users with a programmable digital I/O. The unit has eight 
Ethernet LAN 10/100 ports, and can support 54 wireless clients using the 802.1 1-b/g protocols. 

4.6.5 Test vehicle computer and data provisions 

The existing flight-test provisions on the aircraft comprise a dedicated workstation, an 
auxiliary computer (“R2D2”), and sophisticated data interfaces to the aircraft’s systems. The 
flight test workstation contains a powerful dual-core computer interfaced with 32 ARINC 429 
busses, 32 discretes, and a Wi-Fi broadcast system. The workstation also incorporates a 15-inch 
XGA display and a six-channel digital video recorder, with internal and external camera feeds. 
Workstation SGA video can also be routed to the 8”xl0” Multi-Function Display (MFD) on the 
copilot’s instrument panel which can function as a Class 3 EFB. The “R2D2” auxiliary computer 
is also interfaced to several of the aircraft’s ARINC busses through the AID, has Wi-Fi 
capability, and can drive the copilot’s MFD remote display. Both the workstation and R2D2 
computers are capable of hosting TAP, although these are not the principal TAP computers. No 
changes were required to these systems for the TAP flight trials. 
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Figure 7. Test-bed cockpit. The EFB is mounted on the right-side windshield. 
© 2014 Advanced Aerospace Solutions, LLC. Reprinted with permission. 


4.7 System Test and Evaluation 

The TAP testing is detailed in numerous program documents, including the Flight Trial 
Research Plan and the Flight Test Plan. The following sections highlight important details from 
these plans. 

4.7. 1 Incremental Test Approach 

An incremental risk-mitigation approach was applied to the preparation for the flight 
trials. Testing began with the development of functional human factors mockups of the TAP 
software, followed by a number of incremental builds of the operational software. Three sets of 
simulations were conducted to validate different performance aspects of the TAP software: 

1 . Extensive testing was performed at the NASA ATOE to verify the basic TAP algorithms 
and validate the proposed test scenarios. 

2. End-to-end simulations were conducted at the Operator Performance Laboratory (OPL) 
of the University of Iowa to refine the TAP software, interfaces, operating procedures, 
Human-Machine Interface (HMI), and test procedures (including briefings, debriefings, 
questionnaires, etc.). 

3. Further simulations were conducted using AdvAero’s systems and human factors 
simulator, which has an avionics architecture designed to replicate the Avanti aircraft. 
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The objective of these tests was to further debug the TAP software and integration with 
the aircraft data systems. An additional goal was to practice and refine the specific test 
scenarios to be used during the flight trials. 

4.7.2 Flight Test Program 

The flight test program began upon the successful conclusion of the simulator evaluations 
and incorporated lessons learned from the simulations, where practical. Initial testing comprised 
30 hours of opportunity “shakedown” testing with the TAP system installed and functioning 
while the aircraft was engaged in other duties. The purpose of the shakedown tests was to further 
debug the TAP integration with the aircraft systems. The shakedown phase was followed by a 
36-hour formal test program, including ten formal assessment missions and two demonstration 
flights. 

4.7.3 Individual Flight Profiles 

The formal flight-testing was designed to exercise TAP functionality in four increasingly 
challenging steps: 

1. Verification of the operational data flows to TAP, and verification that TAP was able to 
successfully process the information in real-time. 

2. Verification of TAP interface functionality, per the system requirements. 

3. Observation of test subject interactions with TAP in an operational environment. 

4. Use of TAP to generate an aircrew request to ATC, with optional execution of the 
request. 

A nominal TAP flight comprised a 2.5-hour profile, of which approximately 30 minutes 
were allocated to the departure and arrival segments below 10,000 feet where TAP was in 
Standby mode. The remaining 120 minutes of flight above 10,000 ft. were dedicated to the TAP 
In-Flight Assessment. A typical sequence of test events is shown in Table 4. 
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Table 4. 

TAP Mission Test Activity Sequence 


Time 

Operation 

TO - 10 minutes 

• Power-up aircraft 

• Power-up flight test engineers computers 
and EFB 

TO - 9 minutes 

• Validate data is flowing to each TAP 
installation 

TO - 2 minutes 

• Power-down and stow all non-essential 
hardware 

TO 

• Take off 

TO + 15 minutes 

• Alt>FL100 

• Power up flight test engineers computers 
and EFB 

• Validate data is flowing to each TAP 
installation 

• Flight assessment scenarios 

Eanding - 20 minutes 

• Prepare for landing < FL100 

• Power down and stow all non-essential 
hardware 

Eanding 

• Landing 

Eanding + 1 minute 

• Power-up flight test engineer computers, 
if necessary 

• Backup all collected data 

• Power-down flight test engineer 
computers 

Landing +10 minutes 

• Power-down aircraft, Exit 


Note. Adapted from NASA Flight Test Operations and Safety Report (FTOSR) (Project 
Reference N). 

All of the flight plans comprised outbound and inbound phases, terminating at the airport 
of origin as shown in Figure 8. Each phase comprised a number of legs upon which the TAP 
optimizer acted. Special Use Airspace (SUA), which must be avoided, was incorporated in some 
of these routings to challenge the TAP trajectory optimizer. 
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Figure 8. Representative TAP test - plan view. © 2014 Advanced Aerospace 
Solutions, LLC. Reprinted with permission. 


The vertical test profiles were all conducted at a constant predefined cruising altitude 
above 10,000 feet, the floor for TAP operations, as shown in Figure 9. Vertical deviations 
resulting from optimizer recommendations were allowed. 



Figure 9. Representative TAP test - profile view. © 2014 Advanced Aerospace 
Solutions, LLC. Reprinted with permission. 
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4.7.4 Flight Test Envelope 

All TAP operations were conducted near the center of the aircraft’s Normal Category 
flight envelope. The TAP system remained in Standby mode below 10,000 ft. MSL, the floor 
altitude for the TAP evaluations. Aircraft payload/range limitations effectively limited the 
maximum altitude to FL380 (the aircraft’s certified ceiling is FL410). TAP operations were 
conducted near the aircraft’s maneuvering speed (approximately 200 KIAS / 260 KTAS @ 
FF150), which afforded the maximum margin between the stall and Mmo/Vmo conditions. TAP 
evaluations were conducted with the autopilot engaged, which ensured that all maneuvers 
remained within the aircraft’s certified flight envelope. These parameters are summarized in 
Table 5. 


Table 5. 

TAP Evaluation Flight Test Envelope 


Parameter 

Planned Value 

Notes 

Altitude 

FF150 - FF200 

FF100/MEA Minimum 
FF300 Maximum 

Airspeed 

200 - 220 KIAS 

Approximately Va 

Fateral TAP Maneuver 

Autopilot tum-to-heading 


Vertical TAP Maneuver 

Autopilot climb/descent 


Foad Factor 

Max 1.15 (30° Bank) 

Autopilot limited 

Autopilot Mode 

Autopilot and Yaw Damper 
engaged 


Weight and Balance 

Within normal envelope 


Aircraft Certification 

Part 23 Normal Category 
CofA 


Weather 

VMC/IMC 



Note. Adapted from NNF12AA06C (Project Reference N). 

4.8 Construction/Production Requirements 


The principal TAP aircraft modifications used COTS products installed by authorized 
aircraft modification centers in accordance with the applicable regulations and facility 
certifications. 

4.9 System Utilization and Sustaining Support 

All TAP COTS hardware is maintained and supported in accordance with manufacturer’s 
procedures using approved service resources. The TAP software was maintained by the software 
specialists involved in the program. TAP is designed to be uninstalled between flight trials, and 
will therefore not require any ongoing support. 
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4.10 System Retirement and Material Recycling/Disposal 

All modifications incorporated for the TAP program were FAA certified and permanently 
installed in the aircraft. The systems will remain installed to facilitate planned future testing until 
obsolescence or unserviceability dictate. In this event, the equipment will be disposed of in 
accordance with appropriate procedures for COTS electronics. 

5 Technical Program Planning, Implementation, and Control 

5.1 Program Requirements/Statement of Work (SOW) 

The TAP SOW (project reference K) is confidential, but key program objectives 
pertaining to this SEMP include: 

1. Selection, with technical justification, of a Class 2 EFB hardware system to host the TAP 
software for developmental testing. 

2. Integration of TAP with the selected Class 2 EFB hardware system. 

3. Support for broadband Internet connectivity for the provision of external TAP data. 

4. Minimal changes to existing avionics architectures or displays for near-term forward-fit 
applications. 

5. Accomplish FAA certification and NASA operational approvals for the conduct of the TAP 
flight trials. 

6. Conduct an in-flight assessment of the TAP Application with the objective of identifying 
operational factors unique to the in-flight environment that may affect TASAR application 
functionality, data requirements, Human-Machine Interface (HMI), and operational 
procedures, with the objective of refining the TAP application and concept. 

5.2 Organization 

The TAP program originated from NASA Research Announcement NNH10ZZEA001N, 
Research Opportunities in Aeronautics - 2010, Amendment 7, Subtask 5, Traffic Aware Strategic 
Aircrew Requests (TASAR) Analysis and Development. The contract was awarded to Engility 
Corporation as the Prime Contractor, with AdvAero as the subcontractor. A parallel and 
independent contract was awarded to the University of Iowa Operator Performance Laboratory 
(OPL) for the conduct of some of the full flight-deck TAP simulations. 

5.2.1 Producer/Contractor Organization 

The project customer was NASA Langley and the producers were Engility (Prime) and 
AdvAero (sub contractor). AdvAero was the flight test lead, reporting directly to NASA for the 
conduct of the flight tests. The AdvAero research aircraft remained under the operational control 
of Skyservice of Montreal. 
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5.2.2 System Engineering Organization 


AdvAero adopted an Integrated Product Team for the system engineering functions, as 
shown Figure 10 below. Some of the positions were filled by the same individuals as noted in 
section 6.1, except for those designated as independent in the figure. 



Figure 10. AdvAero TAP Integrated Product Team. © 2014 Advanced 
Aerospace Solutions, LLC. Reprinted with permission. 

















NASA TASAR Systems Engineering Management Plan 
5.2.3 Program Tasks 

The system engineering program tasks approximated Blanchard’s 
shown in Table 6 below. 

Table 6. 

TAP Principal Flight Test System Engineering Tasks 

28 

outline (2008, fig. 6.6), as 

Output 

Primary Responsibility 

Develop Concept of Operations 

Prime contractor 

Develop operational Use Cases 

Prime contractor 

Develop flight-trial aircraft modifications plan 

AdvAero 

Develop HMI Mockup 

AdvAero 

Define flight-trial approval requirements 

AdvAero 

Prepare flight-trial PER presentation package 

AdvAero 

Prepare benefits assessment report 

Prime contractor 

Develop flight-trial research plan 

AdvAero 

Perform flight-trial hazard analysis 

AdvAero 

Select Class 2 EFB system 

AdvAero 

Develop TAP prototype build 

Prime contractor 

Develop Pilot Procedures 

AdvAero 

Prepare Flight-trial IRB approval package 

AdvAero 

Prepare Flight Test Operations and Safety Report (FTOSR) 

AdvAero 

Present flight-trial Final Experimental Review 

AdvAero 

Prepare flight-trial approval artifacts package 

AdvAero 

Prepare flight-trial Readiness Review (FTRR) package 

AdvAero 

Prepare flight-trial reports 

AdvAero 

TAP final build 

Prime contractor 

Develop HMI-procedures design guidelines 

All 

Prepare final report 

All 

Note. Adapted from project SOW (Reference K). 


5.2.4 Supplier Requirements 

Requirements for equipment suppliers and sub-contractors to AdvAero are fully 

defined by the applicable Federal Aviation Regulations. All applicable quality requirements from 

the project SOW were flowed down to these suppliers, ensuring that overall program quality 

goals were maintained. 
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5.3 Key Organizational Interfaces 

The key organizational interfaces differed between contractual and system engineering 
viewpoints. Contractually, the AdvAero Chief Operating Officer reported via the Prime 
Contractor’s Principal Investigator (P.I.) to the NASA Technical Monitor. In practice, a number 
of peer-to-peer reporting paths were followed for efficiency purposes, with all pertinent 
information being sent in parallel via the contractually mandated path. These paths are shown in 
the table below: 

Table 7. 


TAP Reporting Interfaces 


Function 

Interface 

Program administration 

AdvAero COO to Prime P.I. 

Flight operations and safety 

AdvAero P.I. to NASA T.M. 

Safety and QA 

AdvAero P.I. to NASA T.M. 

Software engineering 

Peer-to-peer, cc. P.I. 


Note. Adapted from project SOW (Reference K). 


5.4 Work Breakdown Structure (WBS) 

The detailed WBS is contained in the Flight-Demonstration Aircraft Modification Plan 
(Reference A), which is incorporated into this SEMP by reference. The top-level work packages 
were as follows: 
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5.4. 1 Class 2 EFB selection and installation and certification 

5.4.2 AID selection, installation, and certification 

5.4.3 Autopilot- state annunciation interface 

5.4.4 EFB Landing gear and flap position sensing 

5.4.5 ADS-B TCAS upgrade 

5.4.6 TCAS / transponder control head upgrade 

5.4.7 ADS-B transponder upgrade 

5.4.8 Satellite broadband system selection, installation, and certification 

5.4.9 Broadband antenna installation 

5.4. 10 Miscellaneous TAP Provisions 

5.4. 1 1 Workstation data and video interfaces 

5.4. 12 Workstation power switch relocation 

5.5 Project Schedule and Milestone Charts 

The project schedule is shown in Figure 11 on the following page. 
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2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 


k Name 

Dura... 

Start 

Finish 

Project Start 

Od 

l-Jun-2011... 

l-Jun-2011^. 

Kickoff Meeting 

Od 

28-Jun-201... 

28-Jun-2011... 

1. Use Cases 

80d 

l-Jun-201... 

20-Sep-201... 

Perform Analysis of Traffic Patterns 

4w 

l-Jun-2011... 

28-Jun-2011... 

Define Use Cases 

2w 

29-Jun-201... 

12— Jul— 2011... 

Write Use Cases 

lOw 

13— Ju 1—20 1 . . . 

20-Sep-201... 

Deliver Use Cases to NASA 

Od 

20-Sep-20... 

20-Sep-201... 

2. Certification 

230d 

13-Jul-201... 

29-May-201 ... 

Assess Requirements for Certification 

16w 

13— Jul— 201... 

l-Nov-2011... 

Define Certification Basis with FAA 

26w 

2-NOV-201... 

l-May-2012... 

White Paper to NASA 

Od 

29-May-20... 

29-May-201... 

3. Prototype 

520d 

l-Jun-201... 

28-May-201 ... 

Assess Needs 

8w 

l-Jun-2011... 

26— Jul— 2011... 

Define Requirements 

8w 

27— Jul— 201... 

20-Sep-201... 

Define Design 

5w 

21-Sep-20... 

25-Oct-2011... 

Define Human Interface Design 

4w 

26-Oct-201... 

22-Nov-201... 

Interim Build 1 

16w 

23-NOV-20... 

13-Mar-201... 

Interim Build 2 

3mo 

7-Mar-201... 

29-May-201... 

Demo at LaRC 

Od 

29-May-20... 

29-May-201... 

NASA Contractor Report Year 1 

Od 

29-May-20... 

29-May-201... 

Interim Build 3 

39w 

30-May-20... 

26-Feb-201... 

Interim Build 4 

13w 

27-Feb-20... 

28-May-201... 

4. Human Interface Design Assessment 

370d 

23-NOV-20... 

23-Apr-201... 

HI Requirements to be assessed 

4w 

23-NOV-20... 

20-Dec-201... 

Develop test cases 

8w 

21-Dec-20... 

14-Feb-201... 

Dry Run Build 1 

4w 

14-Mar-20... 

10-Apr-201... 

Dry Run Build 2 

4w 

30-May-20... 

26-Jun-2012... 

HI Assessment 

4w 

27-Feb-20... 

26-Mar-201... 

Data Reduction and Report Generation 

4w 

27-Mar-20... 

23-Apr-201... 

White Paper to NASA 

Od 

23-Apr-20... 

23-Apr-201... 

Closeout 

50d 

24-Apr-20... 

2-Jul-2013... 

Write Opeational Benefits doc 

4w 

24-Apr-20... 

21-May-201... 

Define Flight Test Recommendations 

4w 

22-May-20... 

18-Jun-2013... 

Develop Conference Paper 

4w 

22-May-20... 

18-Jun-2013... 

Assess partnerships for future work 

2w 

19-Jun-201... 

2— Jul— 2013 5... 

NASA Contractor Report Year 2 

Od 

18-Jun-201... 

18-Jun-2013... 


Apr Ijul^loct Jan |Apr |jul |oct Jan |Apr |ji 





% 




Project: MSProjll Manager: 


Page: 1/2 Date: Dec 30, 2013 


Figure 11. Program schedule © 2014 Advanced Aerospace Solutions, LLC. 
Reprinted with permission. 


The milestones leading to the flight demonstrations included: 

1 . ASRB Design and Operational Safety Reviews 

2. Institutional Review Board (IRB) Review 

3. ATOL TAP Build 2 integration testing 

4. AdvAero Simulator TAP HMI evaluations 

5. University of Iowa Operator Performance Laboratory (OPL) Use Case evaluations 

6. Final Experimental Review Briefing 

7. Flight Trial artifact approval 

8. Flight Trial Readiness Review data package distribution 

9. ATOL TAP Build 3 integration testing 

10. Flight Trial Readiness Review (FTRR) 

1 1 . Flight Release Issuance 

12. Flight Demonstrations 
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5.6 Technical Performance Measurement “Tracking” 

The NASA Technical Monitor was responsible for tracking performance measures, 
primarily using qualitative methods. This was primarily achieved via the regular status reviews 
and acceptance of the formal deliverables discussed in sections 5.8 and 5.9, respectively. 

5.7 Program Cost 

NASA awarded the TAP flight test program under a firm- fixed-price contract. The cost 
details are confidential. Internally, AdvAero maintains Key Performance Indicators, earned value 
metrics, and cost data using the Ceridian Dayforce™ system. 

5.8 Technical Communications 

The primary means of technical communications was via scheduled weekly conference 
calls of approximately two hours duration between the NASA Technical Monitor, NASA support 
experts, and the prime contractor’s and sub-contractor’s teams. These calls will be increased in 
frequency - in some cases daily, or even hourly, during the flight trial execution. When 
necessary, direct peer-to-peer communications between engineers were authorized, and the 
Principal Investigators (PI) were always kept informed of the outcome of such discussions. The 
weekly meetings were supplemented by monthly status reports, semi-annual meetings, and 
numerous formal documentation deliverables as discussed below. 

5.9 Program Monitoring and Control 

The NASA Technical Monitor (TM) was responsible for the monitoring and control of 
the program. The two Principal Investigators from Engility and AdvAero were, in turn, 
responsible for achieving the software and flight test objectives, respectively. Issues were 
addressed at the lowest level of the reporting hierarchy and escalated as necessary up to the TM, 
with an attitude of full and open communications and disclosure. The Pis provided formal 
monthly status reports that updated and summarized the accomplishments, action items, program 
risks and mitigations since the last report. The TAP test team also attended semi-annual meetings 
at NASA Langley, and additional meetings were convened on an opportunity basis during 
intervening essential on-site reviews. These included the preliminary and final Flight Test 
Operations and Safety Report (FTOSR) presentations to the NASA Airworthiness and Safety 
Review Board (ASRB). 

5.9. 1 Operator Certification & Training Standards 

AdvAero ’s test aircraft is professionally maintained, operated, and managed by 
Skyservice of Montreal, QC, Canada (http://www.skyservice.com/managedservices.php). 
Skyservice was founded in 1986, and is one of Canada’s premier full service business aviation 
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organizations. The test aircraft operations were governed by Skyservice processes pertaining to 
Part VII, Subpart 702, of the Canadian Aviation Regulations (CARs) (Aerial Work - Flight Test 
Operations). The aircraft and crew were also fully certified by Skyservice to operate under CAR 
Subpart 703, Air Taxi operations. Skyservice has a comprehensive Safety Management System 
(SMS) approved by Transport Canada to Air Carrier standards. 

5.9.2 Operator Audit 

An on-site NASA safety audit of the test aircraft, its installed systems, and the applicable 
documentation was successfully concluded on March 13, 2013 at the Newport News / 
Williamsburg International Airport (KPHF), in parallel with the FTOSR. 

5.9.3 Flight Test Governance 

AdvAero’s flight operations are governed by Skyservice ’s Transport Canada-approved 
Company Operations Manual (COM) and Safety Management System (SMS), which include 
provisions for 24/7 flight following and alerting. AdvAero’s flight-test operations are further 
governed by its Transport Canada-approved Flight Test Operations Manual (Project Reference 
B). This document is more conservative than the stringent commercial air carrier specifications 
that normally govern the operation of the test aircraft. The FTOM addresses the top-level policy 
and requirements for the following operational aspects of all AdvAero flight- test programs: 

1 . Categories of flight test; 

2. Flight test operations control system; 

3 . Safety and risk management system; 

4. Aircraft modifications; 

5. Flight authorities; 

6. Test planning and conduct; 

7. Aircrew qualifications, training and currency; 

8 . Duty time limitations ; 

9. Record-keeping procedures; and 

10. Delegated function. 

All flight operations were conducted in compliance with the more conservative of the 
following applicable documents and regulations: 

• Federal Aviation Regulations (FARs); 

• Transport Canada Civil Aviation Regulations (CARs); 

• Skyservice Company Operations Manual; 
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• AdvAero Flight Test Operations Manual (Project Reference B); 

• NASA Procedural Requirements: Aircraft Operations Management Manual NPR 

7900. 3 C (Project Reference Y). 

The AdvAero FTOM was submitted to NASA on June 1 1, 2012 for validation against the 
requirements of NPR7900.3C and approved by FARC-D1 on Julyl7, 2012. 

5.9.4 Aircraft Maintenance 

Skyservice maintains the test aircraft to Transport Canada Air Carrier (CAR 703) 
standards. The company employs factory-trained personnel (Piaggio Aircraft Industries and Pratt 
& Whitney Canada), and all maintenance releases are performed by Transport Canada certified 
personnel. The aircraft’s PT6A-66 engines are maintained to the highest available Pratt & 
Whitney standard (“ESP Gold”), and the majority of the avionics are either new, or registered 
under the manufacturer’s ongoing warranty plans. The aircraft is always hangared at its home 
base and when it is deployed, subject to availability. 

Skyservice maintains on site a complete electronic and/or paper subscription of all 
required maintenance and technical documentation for the aircraft, its engines, systems, and 
avionics. All maintenance is tracked electronically using Avtrak® software as shown in Figure 


12 . 
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Figure 12. Sample Avtrak® maintenance tracking software printout. 


6 Engineering Specialty Integration 

6.1 Functional Engineering 

The following engineering disciplines were employed for the TAP development and 
testing. Several of the roles were combined for this program: 

1. Test Pilot; 

2. Flight Test Engineer (FTE); 

3 . System Engineer; 

4. Safety Specialist; 

5. Avionics specialist; 

6. Structural Engineer; 

7. HF engineer; and 

8. Software developer. 

6.1.1 Test pilot 

The test pilot, who was also the P.I. for the flight test program, was responsible for the 
safe and efficient planning and conduct of the flight tests. He was also delegated to perform the 
overall systems engineering and certification activities for the test installation, including the 
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Flight Analyst, Human Factors, and TSO approvals. The test pilot acted as the safety monitor 
and final authority for decision-making during the flight tests. 

6.1.2 Flight test engineer 

FTEs were responsible for the safe and effective operation of the installed test and safety 
equipment in the aircraft. The in-flight Test Director was appointed from the flight test engineer 
specialty, as were the Data Engineers. All FTEs also performed system-engineering functions for 
their specialized subsystems. 

6.1.3 Safety specialist 

The Test Pilot / P.I. and Test Director were the two designated safety specialists for this 
program. The safety specialist was responsible for leading the safety planning processes, and was 
directly accountable to the NASA safety organization structure. The Test Director safety 
specialist also led the Institutional Review Board (IRB) activities related to the experimental 
design and protection of the human subjects. 

6.1.4 Avionics specialist and structural engineer 

Both the avionics specialist and structural engineer disciplines were outsourced as part of 
the avionics installation activity. The avionics specialists and structural engineering disciplines 
were required for the FAA certification of the TAP hardware. The avionics specialist was 
responsible for the safety analysis of the avionics architecture for the safe certified systems. The 
structural engineer was required to perform the analysis of the ADS-B antenna installation, which 
required specific FAA approval because it pierced the 9.0-PSI cabin pressure vessel. 

6.1.5 HF engineer 

The HF engineer was responsible for the ergonomic design, HF evaluation, and HF 
compliance of the installed TAP equipment. The Flight Test P.I. performed this function. This 
discipline differs from the prime contractors HF engineer, who was responsible for the human 
factors of the TAP display. 

6.2 Software Engineering 

This SEMP does not address the TAP software engineering, except to the degree that it 
impacted the overall system design. AdvAero software developers performed all analysis, 
design, and coding for the aircraft-side integration of TAP with the other aircraft systems. A 
classic “design to the interfaces” approach was adopted for this task. The data and mechanical 
ICDs were therefore of paramount importance, and required continual updating as the highly 
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iterative development program evolved. AdvAero employed Agile™ techniques to ensure that 
the interim system engineering builds were functional and available for integration testing by its 
partners. Similarly, the prime contractor delivered a number of interim TAP software builds for 
use in the system integration testing activity. A classic waterfall software development model 
would not have worked in this environment, because of the time constraints and inter- 
dependencies of this highly iterative development program. 

6.3 Reliability Engineering 

No dedicated reliability engineering was performed because of the extensive use of 
COTS components and the FAA-certified installation. The test system inherited the reliability 
engineering from these processes and certifications. This SEMP does not address the TAP 
software development program, whose reliability engineering considerations remain proprietary 
to Engility Corporation. 

6.4 Maintainability Engineering 

The hardware installed for this program was COTS sourced and the sub-system 
installations were FAA certified for aviation applications. Careful consideration was given to the 
maintainability aspects of the EFB equipment, particularly regarding in-flight access for 
troubleshooting purposes. The TAP software incorporated extensive built-in test, logging, and 
debugging provisions, and a software engineer was dedicated to monitoring the application’s 
health status during the flight trials. No maintainability problems were encountered related to the 
system installation. 

6.5 Human Factors (HF) Engineering 

The HF engineering for the COTS test installations was in accordance with the Intended 
Function provisions of 14 CFR 23.1301, as determined by the program P.I. and test pilot. No 
specific additional HF processes were employed for the aircraft modifications. 

Although this SEMP does not address the HF engineering for the TAP software, the 
process did have an influence on the system and test design. The program was governed by 
NASA’s Institutional Review Board (IRB) processes, including all required experimental 
reviews. All test team personnel with possible contact with the test subjects were required to take 
on-line IRB training from the Collaborative Institutional Training Initiative (CITI). 

The test design entailed the generation of a number of Use Cases (Reference I) designed 
to probe TAP’s functionality. Robust Pilot Procedures were created from the Use Cases as the 
backbones for the airborne TAP evaluations, and the detailed flight plans were derived from these 
Pilot Procedures. An incremental methodology governed the build up of the test cases, 
commencing with rapid-prototyping usability studies, through two levels of simulation, and 
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culminating in the flight evaluations. Ten test-subjects were scheduled to fly a single 2.5-hour 
mission as part of a between-subjects design. 

TAP was evaluated through a highly structured test program using the Bedford Workload 
rating scale ( Figure 13 ), hand-recorded data, in-flight surveys, digital audio/video recordings, and 
extensive recording from the aircraft’s ARINC 429 data-busses and from the computers hosting 
TAP. The survey instruments were evaluated during the OPL pilot simulation studies and during 
a dry run which preceded the first formal flight evaluations. Prior to their flight, each subject 
received a two-hour formal preflight experimental briefing and TAP training session. During the 
flights, the Test Director administered comprehensive subjective questionnaires and Bedford 
assessments to the test subject at several break points during each mission. An additional one- 
hour electronic survey (using Lime software) was administered to each subject during the mission 
debriefing within an hour of flight completion. This formed the basis of a two-hour open 
debriefing, attended by most of the test team members as well as NASA human factors 
specialists. The paper and electronic surveys were supplemented by full-time digital cockpit 
audio/video recordings and comprehensive digital recordings from each computer hosting TAP. 
The existing aircraft-side data systems also allowed a keystroke -by-keystroke recreation of each 
FMS button-push and readout, with a complete cockpit visualization capability and Google 
Earth™ flight path recreation. The ARINC 429 data logging also allowed each profile to be 
replayed through AdvAero’s research simulator. All of these data will be used to evaluate TAP’s 
performance and to improve its functionality and interface. 

An intense 36-hour flight test program was successfully completed in two weeks, marred 
only by a single aircraft unserviceability unrelated to the TAP installation. Based on the 
preliminary data reduction, many significant and useful findings have already been made in 
relation to the original program objectives. 
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Decision 


Workload Description Rating 



Figure 13. Sample Bedford workload rating scale. 
Adapted from Roscoe and Ellis, 1990. 
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6.6 Safety Engineering 

The test-vehicle is FAA certified with a Normal Category C of A underl4 CFR Part 23. 
The aircraft incorporates a fully firewalled flight-test architecture which functionally and 
physically partitions the copilot’s test station from the triple redundant safety pilot’s (captain’s) 
station as shown in Figure 14. This partitioning required the aircraft to be certified for single-pilot 
operation, as previously discussed. 

All equipment installed for the TAP flight-trials was FAA certified and therefore 
compliant with the safety engineering requirements for its respective certification basis. In 
general, major aircraft modifications were certified using the Supplemental Type Certificate 
(STC) process. Individual systems were certified via Technical Standard Order (TSO) approval, 
where applicable. These certifications invoked RTCA DO- 160 (Reference CC) for 
environmental certification, DO-178B (Reference DD) for software, and DO-254 (Reference FF) 
for computer hardware. The System Safety processes defined in SAE ARP 4754 (Reference HH) 
and AC 23 -1309- IE (Reference DD) were followed for the overall system integration and hazard 
analyses. 

The Principal Investigator, a Canadian government Design Approval Representative test 
pilot, evaluated the TAP installation during several dedicated test flights and 30 hours of 
shakedown testing, for safety and human factors acceptability, prior to the issuance of the 
certification and operational approvals of the system. No substantive issues or shortcomings were 
noted, and the TAP flight evaluations were completed without incident, with the exception of a 
single, unrelated, aircraft system unserviceability. 
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Station & 

Class 3 EFB. 
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Figure 14. Test-vehicle cockpit partitioning. © 2012 Marinvent Corporation. 
Reprinted with permission. 


6.7 Security Engineering 

The TAP software has no ability to affect other aircraft systems because of its advisory 
nature. Accordingly, there were no specific Security Engineering considerations for this 
program. 

6.8 Manufacturing and Production Engineering 

With the exception of the TAP software and small miscellaneous wiring harness 
materials, all equipment for this program was COTS. Accordingly, there were no manufacturing 
or production engineering considerations, except for lead-time allowances and aircraft downtime 
scheduling. 

6.9 Logistics and Supportability Engineering 

With the exception of the TAP software, all systems related to the test program were 
FAA certified COTS items. The logistics and support were therefore based on the normal supply 
chain for the test vehicle and its systems. 

6.10 Disposability Engineering 

All COTS items will be disposed at the end of their useful lives using industry best 
practices. 


NASA TASAR Systems Engineering Management Plan 


42 


6.11 Quality Engineering 

With the exception of the TAP software, all COTS equipment will be certified in 
accordance with the quality standards applicable to the equipment’s respective certification basis. 
The TAP software was developed using best industry practices for software rapid prototyping 
activities. 

6.12 Environmental Engineering 

The TAP flight trials involved the normal operation of a 14 CFR Part 23 certified General 
Aviation aircraft. There were therefore no specific environmental engineering considerations, 
although the Avanti test- vehicle is the world’s most fuel-efficient multi-engine turbine business 
aircraft, which conferred obvious environmental benefits to the program 

6.13 Value/Cost Engineering 

As with any complex fixed-price research project, very careful control was maintained 
over program costs. The major cost influence was “scope creep” from two sources: (1) early 
successes encouraged the leadership team to adopt more ambitious goals as the program 
progressed; and (2) the parallel rapid-prototyping activity between the four main stakeholders 
proved resource intensive. Countering these factors, the chosen test- vehicle was already very 
well equipped to accommodate the proposed testing, which minimized overheads and non- 
recurring expenses. Significant efforts were made to ensure that the system architecture was 
scalable and resistant to obsolescence. This was achieved by the extensive use of expandable 
COTS components that featured software updates to accommodate upcoming capabilities. 

6.14 Other Engineering Disciplines 

N/A 

7 Configuration Management 

All artifacts produced by this program were subject to full versioning, access control, and 
configuration management, as dictated by NASA. AdvAero uses MKS Source Integrity™, 
Atlassian™ collaboration tools, and CertPro, a flight test suite developed by AdvAero for flight 
test planning and control. 

8 Data Management (DM) 

Data collection included video, digital, and hand-recorded media were all managed using 
the collaborative tools described above. Of particular importance, all test subject data were de- 
identified in accordance with NASA IRB procedures defined in the Flight Trial Research Plan 
and Flight Trial Test Plan. 
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9 Program Technology Requirements 

With the exception of the NASA ATOL facility (Sections 0 and 4.7.1), the prime and sub 
contractor teams provided all the required technologies to perform the software programming, 
system engineering, and flight-test tasks associated with the program. 

1 0 Special International Requirements 

The Avanti test-platform is a Canadian-owned and registered aircraft. Accordingly, 
revenue flight-test operations in the U.S.A. required specific FAA authorization. This was 
achieved via OpSpec #056 “NAFTA approval for flight-test operations by C-GJMM in U.S. 
Airspace” which remains in force until Mar 1, 2014. 

11 Risk Management 

The TAP flight-trial risk management process was governed by the most conservative 
criteria from the following documents: 

1 . The NASA Airworthiness and Safety Review Board (ASRB) Process LMS CP-5580 
{Figure 15 and Figure 16); 

2. The AdvAero Flight Test Operations Manual (Project Reference B); 

3. Skyservice SMS Manual (Project Reference P); and 

4. The applicable Federal Aviation Regulations (FAR). 

The following points contained in these documents were salient to the Hazard Analysis: 

1 . The test aircraft will operate under an unrestricted Normal category Certificate of 
Airworthiness, with approvals for day, night, VMC, and IMC operations, including 
approval for flight in known icing conditions. 

2. All TASAR modifications were certified via a Supplemental Type Certificate (STC) 
process, and none of the equipment was experimental. 

3. The aircraft is equipped with state-of the art avionics, including Kalman filtered Inertial 
Navigation System (INS)/GPS navigation with approach capability, Enhanced Ground 
Proximity Warning System (EGPWS), TCAS, satellite data-link, Doppler radar, and 
lightning detection. This equipment exceeds the requirements of section §3. 1.3.6 of the 
Aircraft Operations Management Manual (NPR7900-3C - reference Y) pertaining to 
FAA-approved TCAS and EGPWS systems. 

4. The aircraft was operated and maintained by Skyservice, a leading aircraft management 
company, and maintained using Avtrak® computerized maintenance tracking. The 
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aircraft’s engines are maintained to the highest available Pratt & Whitney standard (“ESP 
Gold”), and the avionics are under the manufacturers’ warranties. 

5. The Pilot-In-Command was an experienced graduate of a recognized one-year Test Pilot 
school, and the aircraft was operated to Public Transport standards by a professional crew 
licensed for such operations, in compliance with the provisions of LMS-CP-0904, 
“Authorizing Flight Aboard Non-LaRC Aircraft'’ (Reference R). 

6. AdvAero’s routine operations are governed by Skyservice’s Company Operations 
Manual (COM) and Safety Management System (SMS), which includes 24/7 flight 
following. AdvAero’s flight-test operations are further governed by its Transport 
Canada-approved Flight Test Operations Manual (Reference B). The FTOM is generally 
more conservative than the stringent commercial air carrier specifications that normally 
govern the operation of the test aircraft. 

The AdvAero FTOM was accepted by LaRC Flight Operations as compliant with 
NASA’s NPR 7900. 3C Aircraft Operations Management Manual (reference Y). The TASAR 
Flight Test Operations and Safety Report (Reference N) and Hazard Analysis (Reference F) 
received approval by the NASA Airworthiness and Safety Review Board (ASRB) on Mar 14, 
2013 and a Flight Safety Release (FSR) was issued on September 1 1, 2013 to conduct the flight 
demonstrations per FMS-CP-5580. The FSR remained in force until December 20, 2013, 
approximately one month following the completion of the TAP flight trials. 
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Project Manager 


AIRWORTHINESS AND SAFETY REVIEW BOARD 
(ASRB) 





Objectives: 

-to conduct reviews and provide guidance 
for all research-related aircraft flight 
operations (manned or unmanned) 
conducted or managed by LaRC 
-to recommend airworthiness and safety 
requirements, standards, procedures, 
specialized personnel qualifications, and 
training for these operations 


Yes 


ASRB Recording 
Secretary 


► 


Send out an 
announcement of 
the review via e- 
mail 


Obtain copies of 
the project's 
Requirements 
Review Results 
and the System 
Safety Program 
Plan from the 
technical team 
and forward for 
inclusion 


Airworthiness and Safety 
Review Board (ASRB) 




LMS-CP-5580 
Rev.C: ED 
Expires 8/31/2015 


Approval Original signed on file November 28, 2010 

Deputy Director Date 

General Information 

The following records are generated by this procedure and should be 
maintained in accordance with LPR 1440.7: 

-Initiation Request for Flight Research Projects Utilizing Non-LaRC Assets, 
LF 434 

-Initiation Request for Flight Projects Utilizing Unmanned Aerial System 

(UAS) LaRC Flight Assets, LF 435 

-Simulation and Flight Work Request, LF 444 

-Meeting Minutes (including, but not limited to, Requests for Action) 

-Flight Safety Release (FSR) 

-Flight Test Operations and Safety Report (FTOSR) 


Definitions 

Design Review: For flight experiments using LaRC aircraft, reviews shall 
be conducted per LMS-CP-0960, Conducting Flight Experiments Utilizing 
Research Directorate (RD) Aircraft. All others shall conduct reviews per 
LPR 7120.7, Space Flight Independent Life Cycle Review Procedural 
Requirements, in accordance with NPR 7120.5; or LPR 7130, Project and 
Task Review Procedural Requirements, in accordance with NPR 7120.8, 
NASA Research and Technology Program and Project Management 
Requirements 

ASRB Package: The package of documents forwarded to the ASRB 
Recording Secretary ten (10) days prior to the board convening. 

ASRB Review: Any and all safety reviews conducted by the Airworthiness 
and Safety Review Board, either in whole or in part and in accordance with 
LAPP 1710.1 and LPR 1710.16 


Note 1 

For flight experiments using LaRC aircraft, use Simulation and Flight Work 
Request (LF 444). For other flight experiments, use either Initiation 
Request for Flight Research Projects Utilizing Non-LaRC Flight Assets (LF 
434) or Initiation Request for Flight Research Projects Utilizing Unmanned 
Aerial System (UAS) LaRC Flight Assets (LF 435). 

Route the request for approval and signature as indicated on the forms. 

Note 2 

-The Principal Investigator/Project Manager represents the project team 
and requests a meeting with the ASRB Chair who determines if a safety 
review is needed 

-Discuss project goals and proposed methods for fulfilling the goals to 
achieve the desired results 

-A limited number of project members and board members attend the 
discussions with the ASRB Chair 

-If a presentation is made, retain the documents in the ASRB file 


Note 3 

The introductory review provides in-depth information about the project to 
the entire ASRB. 


Note 4 

Distribute a paper copy to the: 

-Executive Safety Council (ESC) Chairperson 
-ASRB files 

Distribute electronic copies to all ASRB members as follows: 

-All meeting attendees 
-Select members of the ESC 

-Designated Wallops Flight Facility (WFF) flight operations personnel 


Page 1 of 12 

Verify correct revision before use by checking the LMS Web Site 


Figure 15. NASA Airworthiness and Safety Review Board (ASRB) Process. 
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Project Manager 


Finalize/revise the 
FTOSR, Hazard 
Analysis, and 
responses to 
Request(s) for 
Action and forward 
to the board for 
review 



Airworthiness and Safety 
Review Board Chair (ASRB) 



Perform the 
mission or flight 
operations 
validation 
according to the 
Project Plan and 
present a project 
status review or 
debrief to ASRB if 
requested 
by the ASRB chair 
(see Note 9) 


Forward to the 
executive safety 
council chair to 
resolve any 
remaining issues 


Prepare a Flight 
Safety Release 
(see Note 8) 



LMS-CP-5580 
Rev.C: ED 
Expires 8/31/2015 


Note 5 

The ASRB Package shall be provided to the Recording Secretary ten (10) days prior to 
the scheduled review and includes: 

-The current Flight Test Operations and Safety Report (FTOSR)--Exhibit A is the 
recommended outline to follow for the FTOSR, for both the document and various 
presentations 

-The current Hazard Analysis 

-Responses to Request(s) for Action initiated through the design review process 
-Responses to Request(s) for Action initiated through the ASRB safety review process 
-Meeting minutes from design review(s) 

-Exhibit B, which is a recommended outline, when requesting permission for flights 
involving Unmanned Aerial Systems or Unmanned Aerial Vehicles. Projects should 
consult NASA Interim Directive NM 7900-83 for classifications of UAVs and use it as a 
guide for content. 


Note 6 

ASRB is empowered to conduct the following types of reviews: 

-Preliminary safety review: this review must cover all aspects of the project as 
presented by the Project Manager and will look at airworthiness as well as safety 
issues. A copy of meeting handouts is placed in the ASRB secured file by the 
Recording Secretary. 

-Design safety review: this formal review is conducted before the full Board deals with 
safety and airworthiness issues following the projects lock-down or baselining of the 
final design. Meeting minutes and Request(s) for Action are distributed by the 
Recording Secretary to all concerned with a copy to the Secured Files for the project. 

-Operational safety review: this is the last formal ASRB review. This review ensures 
that all issues have been addressed and the experiment is cleared to proceed. The 
ASRB Chair has the discretion and authority at this stage to issue a Flight Safety 
Release, which authorizes the experiment to begin. 

Distribution of ASRB review material is as follows: 

-All ASRB Board Members 
-All Project Members 
-Project Engineer 
-Principal Investigator 
-Select members of the ESC 



Note 7 

A waiver is requested by ASRB in cases where the risk defined in the Hazard Analysis 
is of a magnitude that is beyond the authority of the ASRB to adjudicate. In those 
cases, the ASRB makes a formal request for review recommendation to the Executive 
Safety Council through the ASRB Chair. The Executive Safety Council Chair then 
notifies the ASRB Chair of any rulings on the risk. 


Note 8 

The Flight Safety Release (FSR) is a memo memorializing the activities of the ASRB 
and flight reviews and authorizing the project to proceed with its planned flight 
activities. The ASRB Chair notes the effective duration of the FSR and any restrictions 
or cautions that may be necessary for the project along with signing off that all safety 
reviews have been successfully completed. The original memo is sent to the Project 
Manager (PM) with a copy to the ASRB Secured Files for this project. The responsilble 
PM for the FSR must renew prior to flight operations if the expiration date is eminent. 


Note 9 

The project status review or debrief is an informal presentation to the ASRB of either the 
project status or of a final Lessons Learned at the end of a project. This review activity 
is not a required one, and does not produce any formal Minutes or Records. However, 
any presentation material which may have been used by the project team in this activity 
is made a part of the Secured Files for this project maintained by the ASRB Recording 
Secretary. 
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Figure 16. NASA ASRB process (cont.) 
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A summary of the Hazards, Mitigations, Residual Risk severity, and Residual Risk 
probability are shown below. The overall assessment was an Extremely Improbable chance of a 
catastrophic failure condition, which represents a LOW overall risk. 



NASA TASAR / TAP Safety Briefing 


TestObjective(s) | Mission Date/Sequence: | Aircraft: C-GJMM 

1. Verification of the operational data flows to TAP, and that TAP is able to successfully process the information in real-time. 

2. Verification of TAP interface functionality, per the system requirements. 

3. Observation of test subject interactions with TAP in an operational environment. 

4. Use of TAP to generate an aircrew request to ATC, with optional execution of the request. 


Hazards and Undesired Events 

Per approved Forms 273 from FTOSR vl .3 dated August 16, 2013 

001 

Damage to aircraft structure due to crew distraction or workload could lead to an aircraft limitation being exceeded (e.g. 
Vmo/Mmo, limit load factor, etc.) 

002 

Personal injury due to falls, impact with workstation, or blows from unsecured TASAR equipment 

003 

Personal injury due to experimental system rack breaking loose and impacting crew personnel 

004 

Personal injury due to fire originating from Workstation, TASAR equipment, or Personal Electronic Devices (PED). 

005 

CFIT due to crew distraction, workload, or Hazardously Misleading TASAR information which, if followed, could lead to a 
compromise in terrain clearance 

006 

Loss of Separation due to crew distraction, workload, or Hazardously Misleading TASAR information which, if followed, could lead 
to compromised aircraft separation 

007 

Personal Injury resulting from adverse Weather Encounter due to crew distraction, workload, or hazardously misleading 
TASAR information 

008 

Personal Injury resulting from inability to execute emergency egress from the aircraft on the ground due to obstruction caused 
by workstation AND/OR loose TASAR hardware and cables 

009 

Personal Injury due to Cabin Depressurization. Loss of cabin airtight integrity due to failure of hardware related to the TASAR 
installation 

010 

Compromise or loss of normal aircraft system operation because TASAR systems interfere electrically or electromagnetically 
with existing aircraft systems 


Controls / Corrective Actions to be briefed 

Flight 

Conduct 

1 . The Pilot-in-Command (PIC) / Safety Pilot will not participate in the TASAR evaluation and will monitor autopilot and flight 
envelope at all times and will have a primary responsibility of maintaining ATC coordination, weather avoidance, and 
aircraft separation. 

2. Operations will be conducted in the heart of the aircraft’s flight envelope (1 0,000’ - FL300), within approximately 20 KIAS 
of the aircraft’s maneuvering speed (Va). 

3. The Hard-Deck for TASAR operations will be 1 0,000ft or the MEA, whichever is higher, so terrain clearance will be 
assured for all TASAR operations. 

4. All flight- testing will be conducted in an Instrument Flight Rules (IFR) environment, with normal ATC separation standards. 

5. ATC clearance will be obtained prior to any non-emergency (e.g. TCAS RA or EGPWS escape) course or altitude 
modifications. 

6. All crewmembers will be briefed on the importance of lookout, see-and-avoid, and the use of the clock system for locating 
targets. 

7. Traffic conflicts and TCAS Traffic Advisories or RAs will be automatic cause for “knock-it-off” for all test points. 

8. Unexpected adverse weather encounters, EGPWS cautions and warnings, and TCAS Resolution Advisories will be 
automatic cause for “knock-it-off” for all TASAR test points. 

9. The PIC will call “knock-it-off” at any time if there is concern about the envelope being exceeded. 

Cabin 

Safety 

10. All occupants will remain seated with safety belts secured, unless the PIC approves deviations from this requirement using 
a challenge and response protocol, considering applicable operational factors (turbulence, anticipated maneuvering, etc.). 

1 1 . The PIC will advise the crew of any pending maneuvers or anticipated turbulence encounters. 

12. Movement about the cabin and seat-changes will be kept to a practical minimum, and will only be performed in smooth air. 

13. EFBs and other loose equipment will be stowed when not in use, and for takeoff, landing, and critical flight phases 
(generally 10,000’ MSL and below). 

Cabin 

EPs 

14. The aircraft is equipped with a full fire fighting kit, including a firefighter’s smoke hood with built-in oxygen and a portable 
Halon™ extinguisher. 

15. AdvAero’s Flight test Operations Manual FTOM requires a designated fire-fighter crewmember, and smoke and fire 
procedures are required to be briefed prior to each flight. 

16. The flight-crew are provided with state-of-art 2-second single-hand-donning oxygen masks and all cabin personnel are 
provided with drop-down oxygen masks that automatically activate at 14,250 ± 250 ft. cabin altitude. 


Figure 1 7. TAP risk assessment and safety briefing. 
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Residual Risk (circled) 

Failure Condition 
Failure Probability 

Minor 

Major 

Hazardous 

Catastrophic 

Probable 

Low 

Medium 



Improbable-Remote 

Low 

Low 

Medium 

Medium 

Extremely Remote 

Low 

Low 

Low 

Extremely Improbable 

Low 

Low 

Low 

o 



Briefing Elements 

Status 

1. 

Roles and Responsibilities: 

SAFETY PILOT / PIC: FINAL AUTHORITY over safety of flight, positive aircraft control, adherence to regs. and limits. 
TEST DIRECTOR: optimizes flow and completion of test points, coordinates crew to achieve test objectives. 

DATA ENGINEER collection of data in accordance with Test Director’s requirements. 

FIRE CHIEF: in charge of firex and smoke hood. Distributes smoke goggles to pilots. Performs cabin fire drill. 

N/A □ 

Briefed □ 

2 . 

Aircraft Identification and Requirements (incl. Flight Permit and any restrictions, especially re. autopilot usage) 

C-GJMM. Standard C of A. OpSpec #056 (NAFTA approval for flight-test operations by C-GJMM in U.S. Airspace) 
Issued March 1, 2013, valid until Mar 1, 2014 

N/A □ 

Briefed □ 

3 . 

Flight Envelope / Configurations / Weight & Balance / Limits 

Normal P180 Flight envelope. 10,000 MSL TAP floor. Approx. Va at cruise for TAP operation. 

N/A □ 

Briefed □ 

4 . 

Aircraft Safety Brief and Personal Equipment 

Exits, evacuation, 02 masks, life jackets, brace positions, survival and first aid kits, fire extinguisher and smoke hood, 
signals. Gravol, airsickness bags, “potty” procedures and access. 

N/A □ 

Briefed □ 

5 . 

Cockpit Brief 

Safety harness, 02 masks, ICS /radio selection and volume, EFIS, ELT operation, emergency speeds and configurations. 

N/A □ 

Briefed □ 

6 . 

Test Point Conduct and Abort Procedures 

“Abort, Abort” (except during take-off roll). PI recovers to level flight or escape manoeuvre, as required. 

N/A □ 

Briefed □ 

7 . 

Radio procedures 

Sterile cockpit below 10,000 ft. Minimize intercom usage. Brief Intercom silence hand-signal. 

N/A □ 

Briefed □ 

8. 

Traffic procedures 

Use of clock reference, high/low/threat/no threat. Pilot subjects can take control to avoid traffic in extreme circumstances, 
except during take-off and landing. 

N/A □ 

Briefed □ 

9 . 

Data/Photo/Video Requirements 

In accordance with AdvAero NNL12AA06C TASAR Flight Trial Data Collection Plan dated Nov 8, 2013, or later edition. 

N/A □ 

Briefed □ 

10 . 

Weather Minima and Flight Rules 
Standard IFR minima apply. 

N/A □ 

Briefed □ 

11 . 

ATC Coordination, special airspace requirements 

Standard TAP Flight Plans on file with ATC and ATCC. 

N/A □ 

Briefed □ 

12 . 

Fuel Requirements and Bingo fuel 

Standard IFR reserves, including 45 min. reserve after completing approach at alternate airport. 

N/A □ 

Briefed □ 

13 . 


N/A □ 

Briefed □ 

14 . 


N/A □ 

Briefed □ 


Mission Briefing and Risk Acknowledgement (print and sign) 

Date: 

Safety Pilot PIC: 

John Maris 

Participant Pilot: 

Test Director: 

Mark Haynes 

Aircraft Engineer: 

Software Engineer: 

NASA Monitor: 

Other: 

Other: 


Figure 18. TAP safety briefing (cont.) 
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APPENDIX 1 AW&ST Article 

Aviation Week and Space Technology Report on TAP, December 2, 2013 


Soft Savings 

NASA software helps pilots 
save time and money 

John Croft Newport News, Va. 

B y mid-2014, pilots flying for at least one U.S. carrier 
could be able to save passengers time and their em- 
ployer money with the push of a touchscreen and a 
verbal request to air traffic control during the cruise portion 
of a flight. 

The capabilities are part of the NASA Langley Research 
Center’s Traffic Aware Planner (TAP), an application that 
runs on electronic flight bags (EFB) in the cockpit. NASA 
flight-tested the system for the first time on an Advanced 
Aerospace Solutions Piaggio P.180 avionics 
testbed for two weeks in November, generat- 
ing input from a consultant pilot and eight 
airline pilots who evaluated the application. 

Preliminary results of the flight test were 
positive, giving a boost to agreements in the 
works for airline deployment. David Wing, 

Traffic Aware Strategic Aircrew Requests 
(Tasar) principal investigator with NASA’s 

Pilots use the touchscreen on NASA’s 
TAP application on an EFB to optimize 
routes for time and fuel savings. 

Langley Research Center, says Virgin Amer- 
ica is interested in using the software, as is 
a mainline carrier, assuming the application 
can be ported over to the iPad. 

Paul Harrison, flight technical manager 
for Virgin America and one of the volunteer 
pilots to fly in the Piaggio, says TAP could be 
one of the first applications to run on newly installed class 3 
EFBs in the airline’s 53 Airbus A319 and A320 aircraft next 
year, albeit initially without the automatic dependent surveil- 
lance broadcast (ADS-B) “in” traffic feature. “Our draw to it 
is for fuel savings,” says Harrison. “We do a lot of transconti- 
nental flights, and the longer the flight, the more the savings.” 
Along with ADS-B “in,” TAP uses broadband input for 
wind, airspace and weather information to help pilots op- 
timize horizontal and vertical routing based on benefits to 
fuel burn, time en route, or a combination of the two. Behind 
the application is more than a decade of NASA research into 
self-separation, and more recently, a push from the Office of 
Management and Budget to develop tools that drive interest 
in voluntary equipage for ADS-B, says Wing. 

Powering the application is a pattern-based genetic algo- 
rithm augmented by pilot-selected route optimization crite- 
ria that computes 500-800 trajectory alternatives waypoints 
every minute. Pilots can also use a manual mode to check for 
fuel or time savings at alternate altitudes or routing, with a 
maximum of two off-route waypoints, a number selected to 
limit air traffic controllers’ workload. 

TAP uses ADS-B data to determine if there are traffic 
conflicts with potential re-routes, a check that increases the 
likelihood that controllers might approve the request. The 


Piaggio is equipped with an ACSS TCAS 3000 ADS-B unit 
and Inmarsat broadband, which is used to bring in wind val- 
ues and information about special use airspace and weather 
disruptions. The system is meant to be used above 10,000 ft. 
so as not to interfere with high-workload portions of a flight. 

“It’s a non-safety-critical app,” says NASA’s Wing. “We’re 
not changing roles of pilots and controllers. Pilots can already 
ask for a trajectory change. Controllers assess the request 
for safety, and approve or deny it.” 

Wing says pilots on most of the 2.5-hr. test flights were 
approved for one or more route changes based on TAP guid- 
ance. Pilots used one of three routes for the test flight, each 
with differing air traffic control or airspace complexities. 
Wing says the flight test was not meant to directly measure 
fuel and time savings, given that routes were “round-robin” 
and software did not include a performance model for the 
Piaggio. Rather, the test was meant to determine how TAP 
performed with on-board and external information, to ob- 


serve how the pilots interacted with the system and to gen- 
erate change requests to air traffic control. “In my view, we 
accomplished this objective,” says Wing. 

An earlier study conducted by NASA subcontractor En- 
gility Corp. determined that network carriers could save as 
much as 4.2 min. per flight by optimizing for time, or as much 
as 575 lb. of Jet A by optimizing on fuel burn. For a low-cost 
carrier, the savings are somewhat smaller — a maximum of 
2.9 min. or 406 lb. of fuel saved, respectively. The numbers 
appear relatively small in isolation, but could be significant if 
aggregated across a carrier’s fleet. The analysis considered 
510 flights between July 11-20, 2012, flying between 12 U.S. 
city-pairs. 

Engility also developed the TAP software and conducted 
the flight trials with its partner, Advanced Aerospace, the 
owner of the Piaggio. NASA also contracted with Rockwell 
Collins to assess implementation requirements in terms of 
certification approval for the application (their conclusion: 
“low certification approval threshold”) as well as to conduct 
human-in-the-loop simulations with 12 airline pilots last sum- 
mer. Those simulations, using a Boeing 777-200LR simulator 
at the University of Iowa’s Operator Performance Laboratory, 
found that TAP has a “negligible effect on pilot workload” and 
that situational awareness was not degraded. © 
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